Explain the COSO ERM framework.

COSO ERM (the 2017 'Enterprise Risk Management — Integrating with Strategy and Performance') frames risk management not as a standalone compliance exercise but as integral to setting and executing strategy and driving performance. It has five interrelated components: Governance & Culture (board oversight, operating structure, ethical values); Strategy & Objective-Setting (analyzing business context, defining risk appetite, evaluating alternative strategies); Performance (identifying, assessing, prioritizing risks and selecting responses in pursuit of objectives); Review & Revision (assessing how the ERM is working and improving it); and Information, Communication & Reporting. Underpinning these are around twenty principles. The key 2017 shift from the older cube was linking ERM explicitly to strategy — recognizing that the biggest risk is often choosing the wrong strategy — and putting risk appetite at the center of decision-making, rather than treating ERM as a back-office risk-list exercise.